SOC 2 security awareness training: what auditors actually look for
What the AICPA Trust Services Criteria say about security awareness training (CC2.2, CC1.4), why points of focus are guidance, and the evidence that can span a Type 2 period.
SOC 2 is an attestation by an independent CPA firm against the AICPA Trust Services Criteria, not a certification. The Security criteria are part of every SOC 2 report. This post sets out the awareness wording under CC2.2, what points of focus are, and the evidence that can span a Type 2 period.
Key takeaway
CC2.2 has a point of focus about a security awareness training programme. Points of focus “may assist” management and the auditor; they do not change the criteria. Your auditor decides what evidence is enough.
The criteria and the point of focus
| Detail | Wording |
|---|---|
| CC2.2 (COSO Principle 14) | “The entity internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.” |
| CC2.2 point of focus | “Communicates Information to Improve Security Knowledge and Awareness — The entity communicates information to improve security knowledge and awareness and to model appropriate security behaviors to personnel through a security awareness training program.” |
| CC1.4 (related) | “The entity demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.” |
AICPA describes points of focus as representing important characteristics of the criteria that may assist management and the auditor in judging whether controls were suitably designed and operated effectively. They do not rewrite the criteria.
What auditors look for
For a Type 2 report, auditors sample how the control operated across the examination period, not on a single date. They often ask for the training policy, proof that people were trained during the period, and evidence the control kept running. Recurring simulations with dated reports and completion records are one way to produce that sampleable trail.
Why phishing simulation helps (and what the text says)
Recurring simulations give dated, measurable results across the audit period: campaign reports, completion records for people who clicked, a trend report and an interaction audit trail. That helps you show both training and resilience.
The criteria name a security awareness training programme, not phishing simulation. How often you train, in what format, and how you show it works are for you to define in your controls, and for your auditor to test.
Evidence checklist
- Campaign reports and per-person completion records dated within the examination period (CC2.2 point of focus).
- Recurring campaigns across the period and an executive trend report (Type 2 operation over time).
- Interaction audit trail and CSV, PPT or PDF exports the auditor can sample.
How SecurityRing helps
SecurityRing gives those outputs for the awareness-training control. Its reports are not mapped to SOC 2 criteria. A SOC 2 report is issued by a CPA firm, not by a tool. SecurityRing itself is SOC 2 ready (no report or attestation exists yet); that is our own posture, not yours.
Sources
Every clause, incident and figure above comes from these official or original sources.
- AICPA2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality, and Privacy (with revised points of focus, 2022)Published 1 January 2022 · Accessed 16 October 2026.
